Technical Information
To ensure autorun and distribution:
Modifies the following registry keys:
- [<HKLM>\SOFTWARE\Classes\pcast\shell\open\command] '' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~1.EXE "%1"'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'YLive.exe' = '%PROGRAM_FILES%\Yahoo!\Assistant\YLive.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'ad' = '%PROGRAM_FILES%\ad\ciel.exe'
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 'PigUpdate' = '%PROGRAM_FILES%\ad\DownLoadPig.exe'
Creates or modifies the following files:
- %HOMEPATH%\Start Menu\Programs\Startup\ГЁСЫНшВзµзКУ.lnk
Malicious functions:
To bypass firewall, removes or modifies the following registry keys:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~1.EXE' = '%PROGRAM_FILES%\pcast\PodcastbarMini\PODCAS~1.EXE:*:Enabled:Share Streaming'
Creates and executes the following:
- '%PROGRAM_FILES%\pcast\PodcastbarMini\Start.exe'
- '%PROGRAM_FILES%\ad\rjzc071_yassist.exe'
- '%PROGRAM_FILES%\Yahoo!\Assistant\ylive.exe'
- '%PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe'
- '%PROGRAM_FILES%\ad\ciel.exe'
- '%PROGRAM_FILES%\ad\DownLoadPig.exe'
- '%PROGRAM_FILES%\ad\pcastbarminis-1.0.0.7_wl_056.exe'
- '%PROGRAM_FILES%\ad\bind_8308.exe'
Sets a new unauthorized home page for Windows Internet Explorer.
Modifies file system :
Creates the following files:
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\alertnew.bmp
- %PROGRAM_FILES%\pcast\PodcastbarMini\pbmini.config.xml
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\anitvirus.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\CoolBar\profile.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\adkiller.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\alert.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\hilight.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\iefix.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\logo.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\assist.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\clear.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\custheme.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\search.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\searchtop.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\settings.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\musiclink.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\musictop.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\picture.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SecurityBar\prodef.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SecurityBar\profile.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\CoolBar\prodef.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\yphtb.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SearchBar\prodef.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SearchBar\profile.ini
- %PROGRAM_FILES%\pcast\PodcastbarMini\itv.xml
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\U98D4X8H\radio[1].xml
- %TEMP%\tem8.tmp
- %PROGRAM_FILES%\Yahoo!\Assistant\YAlive.dll
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\itv[1].xml
- %TEMP%\tem7.tmp
- %PROGRAM_FILES%\pcast\PodcastbarMini\test.xml
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\YPORKZYZ\pcast_install[1].html
- %TEMP%\temB.tmp
- %PROGRAM_FILES%\pcast\PodcastbarMini\radio.xml
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\2VAZY7AN\test[1].xml
- %TEMP%\tem9.tmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\picture.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\search.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\searchtop.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\music.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\musiclink.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\musictop.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\SearchBar\profile.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\SecurityBar\prodef.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\SecurityBar\profile.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\settings.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Images\yphtb.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\SearchBar\prodef.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\music.bmp
- %PROGRAM_FILES%\pcast\PodcastbarMini\PodcastBarMini.exe
- %PROGRAM_FILES%\pcast\PodcastbarMini\pCastCtl.dll
- %TEMP%\nsh6.tmp
- %TEMP%\nsw3.tmp\NSISdl.dll
- %PROGRAM_FILES%\pcast\PodcastbarMini\version.ini
- %PROGRAM_FILES%\pcast\PodcastbarMini\Start.exe
- %PROGRAM_FILES%\Yahoo!\Assistant\Update\ylive.exe
- %PROGRAM_FILES%\Yahoo!\Assistant\Update\yhelper.dll
- %PROGRAM_FILES%\Yahoo!\Assistant\Update\yal01.dat
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\yalive.dll
- %PROGRAM_FILES%\Yahoo!\Assistant\ires.dat
- %PROGRAM_FILES%\pcast\PodcastbarMini\PodcastbarMini.url
- %PROGRAM_FILES%\ad\DownLoadPig.exe
- %PROGRAM_FILES%\ad\rjzc071_yassist.exe
- %PROGRAM_FILES%\ad\pcastbarminis-1.0.0.7_wl_056.exe
- %TEMP%\E_4\krnln.fnr
- %PROGRAM_FILES%\ad\ciel.exe
- %PROGRAM_FILES%\ad\dmshell.dll
- %TEMP%\nsr2.tmp
- <Current directory>\dmconfig.cfg
- %TEMP%\nsw3.tmp\System.dll
- %PROGRAM_FILES%\ad\bind_8308.exe
- %PROGRAM_FILES%\ad\2.0.0.2\dmplayer.dll
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\alertnew.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\anitvirus.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\assist.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\CoolBar\profile.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\adkiller.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\alert.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\hilight.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\iefix.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\logo.bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hc_pig[1].asp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\clear.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\custheme.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\yal01.dat
- %PROGRAM_FILES%\Yahoo!\Assistant\yhelper.dll
- %PROGRAM_FILES%\Yahoo!\Assistant\ylive.exe
- %PROGRAM_FILES%\Yahoo!\Assistant\Update\Assist\yasbar.dll
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\yasbar.dll
- %TEMP%\setuprun.exe
- %PROGRAM_FILES%\pcast\PodcastbarMini\uninst.exe
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\coolbar.cab
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\CoolBar\prodef.ini
- %HOMEPATH%\Start Menu\Programs\ГЁСЫНшВзµзКУ\Website.lnk
- %HOMEPATH%\Start Menu\Programs\ГЁСЫНшВзµзКУ\Uninstall.lnk
- %HOMEPATH%\Desktop\ГЁСЫНшВзµзКУ.lnk
Deletes the following files:
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\search.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\picture.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\settings.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\searchtop.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\music.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\logo.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\musictop.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\musiclink.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\coolbar.cab
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SecurityBar\profile.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\yalive.dll
- %PROGRAM_FILES%\Yahoo!\Assistant\ires.dat
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SearchBar\prodef.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\yphtb.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SecurityBar\prodef.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\SearchBar\profile.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\iefix.bmp
- %HOMEPATH%\Local Settings\Temporary Internet Files\Content.IE5\KHMHGZ4F\hc_pig[1].asp
- %PROGRAM_FILES%\Yahoo!\Assistant\Update\ylive.exe
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\CoolBar\profile.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\CoolBar\prodef.ini
- %PROGRAM_FILES%\Yahoo!\Assistant\Update\Assist\yasbar.dll
- <Current directory>\dmconfig.cfg
- %PROGRAM_FILES%\Yahoo!\Assistant\Update\yhelper.dll
- %PROGRAM_FILES%\Yahoo!\Assistant\Update\yal01.dat
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\clear.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\assist.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\hilight.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\custheme.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\alert.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\adkiller.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\anitvirus.bmp
- %PROGRAM_FILES%\Yahoo!\Assistant\Assist\Update\Images\alertnew.bmp
Network activity:
Connects to:
- 'dc##.dmcast.com':80
- 'it#.mop.com':80
- 'p-##.io8.org':8080
- 're#.##ast.dudu.com':80
- 'pc####l.dudu.com':80
- 'pi#.##ongsou.com':80
- 'fi###.qqhelper.com':80
- 'localhost':1043
- 'www.si##.com.cn':80
TCP:
HTTP GET requests:
- dc##.dmcast.com/script/login.asp?ve###################################################################################################
- dc##.dmcast.com/script/update.asp?ve##########################################
- it#.mop.com/radio.xml?ti###########
- re#.##ast.dudu.com/rep/pcast_install.html?lc###############################################################################################################################################
- it#.mop.com/test.xml?ti###########
- pi#.##ongsou.com/pighc/hc_pig.asp
- fi###.qqhelper.com/bindsoft/bindsetup.exe
- www.si##.com.cn/?&u###########################
- it#.mop.com/itv.xml?ti###########
- pc####l.dudu.com/pcastbarup/rls/updateprogmini.php?ve#########################
UDP:
- DNS ASK dc##.dmcast.com
- DNS ASK it#.mop.com
- DNS ASK p-##.io8.org
- DNS ASK re#.##ast.dudu.com
- DNS ASK pi#.##ongsou.com
- DNS ASK fi###.qqhelper.com
- DNS ASK pc####l.dudu.com
- DNS ASK www.si##.com.cn
Miscellaneous:
Searches for the following windows:
- ClassName: 'Shell_TrayWnd' WindowName: ''
